NEAR AI Cloud Brings Private Inference to Brave Leo

Brave Leo, the AI assistant built into the Brave browser, now runs on private inference from NEAR AI Cloud. Conversations on GLM 5.3 Flash execute inside hardware-enforced enclaves where the cloud host, the GPU operator, and NEAR AI itself are cryptographically locked out.

Brave serves over 128 million monthly active users, and Leo ships inside the browser they already use. Brave began deploying NEAR AI trusted execution environments in November 2025, running DeepSeek V3.1 in Brave Nightly for early experimentation. This release extends private inference from Brave's testing channel to the full production browser: every Leo user who selects GLM 5.3 Flash gets it.

Proofs are stronger than promises

A browser assistant handles the most sensitive material in computing: the pages you read, the drafts you write, the financial and medical questions you would never want public. Nearly every assistant protects that material with a policy. A policy is a promise. The prompt is still visible at runtime, to logging systems, to monitoring tools, and to the people operating the infrastructure.

Model selection carries the same weakness. Published research on model substitution shows that API providers can quietly route traffic from an expensive model to a cheaper one, and users have no way to detect the swap. The provider's economics reward exactly that behavior.

Brave built Leo against this grain from the start: no chats stored in the cloud, no IP logging, no training on user conversations. When Brave introduced TEE-backed inference last November, it framed the goal as replacing provider promises with verification. This integration completes that move for GLM 5.3 Flash. Privacy and model integrity become properties a user can check, not claims a user must accept.

How it works

NEAR AI Cloud runs inference inside trusted execution environments built on Intel TDX and NVIDIA Confidential Compute:

• End-to-end encryption. Leo encrypts each prompt in the browser with Oblivious HTTP, to a key that exists only inside the enclave. Brave's relay strips the user's IP address before forwarding, so NEAR AI never learns who is asking, and Brave never sees what they ask.
• Data isolation. Requests from Leo are encrypted into the enclave. Prompts decrypt only inside it, and memory stays encrypted throughout execution.
• Secure processing. The host operating system, the GPU operator, and NEAR AI are locked out at the hardware level. No one in the serving path can read the conversation or the response.
• Verifiable execution. Every response is signed inside the enclave, and hardware attestation proves the computation ran in a genuine TEE, on NEAR AI's open-source code, serving the model the user chose.

Verification does not rest on NEAR alone. Before Leo's browser receives the enclave's key, Brave's own open-source verifier checks the TDX quote against Intel's signature and the GPUs against NVIDIA's attestation service, and rebuilds NEAR AI's code from public source to confirm it matches what runs. No pass, no key. The party proving the environment is secure is not the party operating it. NEAR AI Cloud also returns an Intel-signed token from Intel Trust Authority, alongside the raw attestation evidence anyone can check.

That last property makes model transparency real. GLM 5.3 Flash is an open-weights model released under the MIT license, so the model being attested is one anyone can download, inspect and benchmark. Attestation and a hardware-attested deployment log confirm the model a user picked is the one answering.

What user-owned AI requires

User-owned AI is an engineering standard, not a slogan. It requires three properties at once: (1) the user's data remains theirs during inference, (2) the model serving them is one they chose and can verify, and (3) both guarantees are enforced by hardware and cryptography rather than by contract. Assistants that meet one of the three are common. Leo on NEAR AI Cloud meets all three in a consumer product, at the surface where people do most of their thinking online. AI in the browser now answers to the person using it.

“In 2014, I argued in 'Trust but Verify' that users shouldn't have to place blind trust in the software they rely on. They should be able to verify it; this is a user-first principle. AI has raised the stakes, yet too much of it still runs on 'trust me bro' promises, often at the user's expense. With the NEAR AI integration in Brave Leo, we're bringing unmatched 'trust but verify' principles to AI: your conversation is sealed in your browser, opened only inside verified TEEs hosting your choice of open-source models, and the code that proves privacy is open for anyone to check. This is a first for AI chats in browsers and we're excited to offer this thanks to our longstanding partnership with NEAR.”

Brendan Eich, co-founder and CEO of Brave

“Brave extending confidential inference from NEAR AI to all their users is an exciting milestone. Brave's and NEAR's values are aligned on the importance not just of privacy, but also verifiability for all. Browsers are a primary computing interface that handles all of our personal information, so it's critical that AI is introduced in a user-owned way.”

Illia Polosukhin, co-founder of NEAR

Brave joins Venice AI, Abound, and the Government of Bermuda, which run production workloads on NEAR AI Cloud.

Get started

Already using Brave? Open Leo's model settings and select GLM 5.3 Flash. If you're new, download Brave and Leo is already built in.

If you have ever shelved an AI feature because the data couldn't leave your control, Brave just showed what the alternative looks like. Tell us about your workload and we'll walk you through what deploying it takes.